Basics

Every new beginning comes from some other beginning’s end.

– Seneca

Table of Contents

• Definition

  A practical definition of threat hunting, how it differs from SOC alert triage and detection engineering, and why hunts should leave useful security work behind.

• Hierarchy of Needs

  Why threat hunting depends on basic operational foundations such as asset inventory, telemetry, detection, triage and incident response capability.

• The Threat Hunter Persona

  What makes a threat hunter useful in practice: curiosity, technical range, analytical discipline, communication skills and the ability to turn uncertainty into structured security work.

• Analyst Mindset

  A practical explanation of the analyst mindset in threat hunting, including thought patterns, structured reasoning, evidence handling, uncertainty, lateral thinking, bias, judgement and communication.

• Indicators

  A practical explanation of indicators of compromise, attack and behaviour, and how threat hunters use indicators to build context, form hypotheses and improve detections.

• Context Before Conclusion

  Why threat hunters should treat indicators, alerts and anomalies as starting points, and build enough context before deciding what an observation means.

• From Alerts to Hypotheses

  How SOC alert handling can develop into hypothesis-driven threat hunting by turning observations, gaps and recurring questions into structured investigations.

• Creating Hypotheses

  How to create threat hunting hypotheses that are specific, testable, relevant and useful enough to drive a real hunt.

• Planning a Threat Hunt

  How to turn a hunting idea or hypothesis into a scoped, executable and reviewable threat hunt plan.

• How to Start a Threat Hunting Program

  How to start and grow a threat hunting programme by establishing foundations, defining objectives, running structured hunts, and turning results into operational improvement.

• When to Engage Threat Hunters

  When threat hunters should be involved, how they complement SOC triage, incident response and DFIR, and when hunting is the wrong tool for the job.